Privacy Policy

Last updated: 23.01.2026

1) Who we are

This privacy policy explains how Hannah Veale Photography (“we”, “us”, “our”) collects and uses personal data when you enquire, book, attend a session/event, receive galleries, or engage with our marketing.

Data Controller: Hannah Veale Photography

Contact email (privacy enquiries): hannah@hannahvealephotography.com

Address: 5, Salford Road, Oxford OX3 0RX

Website: www.hannahvealephotography.com

If you have any questions about this policy or how we use your data, please email hannah@hannahvealephotography.com

2) The personal data we collect

Depending on how you work with us, we may collect:

A) Enquiry and booking information

Name, email address, phone number
Your messages and enquiry details
Booking details (date, location, package choices), contracts and admin notes

B) Client questionnaires (including maternity/newborn)

Details you provide to help plan your shoot (for example: due dates and birth details, preferences, timings, family members’ names/ages as relevant to the session)

C) Photographs and video

Photographs and/or video footage of you and/or your family/children (including identifiable images)

D) Payments and accounting

Payment status, invoices, receipts and transaction references
(We do not store full card details; payment providers handle card processing.)

E) Website, cookies and advertising data

IP address, device/browser information, and how you interact with our website
Analytics and ad-measurement data where you consent (see Cookies section)

F) School/theatre/dance group work

Where we photograph at a school, theatre, dance school or similar setting, we may also receive:

Participant/cast lists or schedules shared by the organiser (e.g., school/theatre company), where needed to deliver the service.

3) Where we get personal data from

We collect personal data from:

Our website/contact forms
Email, phone/SMS/WhatsApp, and social media messages
Mailing list sign-ups
Our booking system/client portal
Our online gallery provider
Schools/theatre companies/venues when they are organising group photography and provide participant information

4) How we use your personal data and our lawful bases

UK GDPR requires a lawful basis for processing. We use your data for:

A) To respond to enquiries and manage bookings

Purpose: respond to your enquiry, provide quotes, schedule sessions, send contracts, manage admin.

Lawful basis: Legitimate Interests (running our business and responding to you) and/or Contract (when you book).

B) To deliver photography/videography services

Purpose: plan your session, take photographs/video, edit and retouch images, deliver galleries, provide prints/products where applicable.

Lawful basis: Contract (to deliver what you book) and Legitimate Interests (professional administration and quality control).

C) To take payment and keep financial records

Purpose: payments, invoicing, tax/accounting compliance.

Lawful basis: Contract and Legal Obligation.

D) To send important service communications

Purpose: confirmations, reminders, gallery delivery, product updates, changes to bookings.

Lawful basis: Contract and Legitimate Interests.

E) Marketing (portfolio, social media, website, brochures)

Purpose: show examples of our work and promote our services.

Lawful basis: Consent (we only use identifiable client images for marketing when you opt in).

You can withdraw marketing consent at any time (see Your Rights).

F) Mailing list (newsletters and offers)

Purpose: send newsletters, launches, offers, and helpful updates.

Lawful basis: typically Consent (where you sign up) and/or Legitimate Interests for limited updates to existing clients where permitted by law.

You can unsubscribe anytime using the link in emails.

5) Children’s data

We photograph children regularly.

For private family sessions, marketing use of identifiable images is opt-in only.
For schools/theatre/dance organisations, the organiser may collect parental permissions for photography. Where we provide group galleries, parents can contact us to discuss restrictions or removal requests (see Group Work section).

6) School / theatre / dance school group photography: roles and responsibilities

When we photograph at a school, theatre company, dance school, or similar organised setting:

The organiser (e.g., school/theatre company) typically decides whether photography will take place and how permissions are collected — they may act as a Data Controller for participant information and consent management.
We act as a Data Controller for the images we create and the systems we use to deliver them, unless otherwise agreed in writing.

Face search / face recognition in group galleries

For some group galleries (for example dance school performances), our gallery provider may offer a feature that helps parents find images containing a particular face. This can involve analysing faces within the gallery.

Currently, consent for photography is obtained by the organiser (e.g., the school), but specific consent for face search may not always be explicitly collected.
If you have concerns about face search features, you can contact us at hannah@hannahvealephotography.com and we will discuss available options, such as disabling the feature for a gallery (where possible) and/or removing images upon request.

7) Editing and cloud processing (including AI tools)

We use professional editing software to process images.

Evoto desktop editor (cloud sync enabled)

We use the Evoto desktop editor. We have disabled optional “content analysis” settings intended to support product improvement/training. We currently have cloud synchronisation/storage enabled so projects can be stored and synced in the cloud as part of our workflow.

Other editing tools

We also use tools such as Adobe Lightroom and Photoshop for editing/retouching. We may use additional software for workflow efficiency.

Imagen

We currently have Imagen Cloud Storage switched off in our workflow. If we later enable any feature that uses client images for analysis/training, we will update this privacy policy and our settings/consents accordingly.

Important: We do not use client images for marketing unless you have opted in.

8) Who we share personal data with (processors/subprocessors)

We only share personal data when necessary to run our business and deliver your service. Depending on your interaction with us, we may use:

Booking/CRM: Studio Ninja (contracts, invoices, questionnaires, client management)
Online galleries & delivery: Pic-Time (proofing, downloads, gallery access; may include face search in some group galleries)
Email marketing: MailerLite (newsletter and marketing emails)
Website platform: Pixieset
Payments: Stripe (card payments and payment links)
Accounting: QuickBooks Self-Employed (financial records)
Email and cloud services: Google Workspace (email, documents)
Storage/backups: iCloud (storage and backup of business files/images)
Editing/production: Adobe (Lightroom/Photoshop), Evoto, and video tools such as DaVinci Resolve

Subcontractors (editors/PA)

We may use subcontractors (e.g., remote editors and/or a PA) who can access limited client information and/or images to help us deliver services efficiently. We only share what is necessary for their role and ask them to handle information responsibly.

9) International data transfers

Some of the providers we use may store or process data outside the UK. Where this happens, we take steps designed to ensure appropriate safeguards are in place (for example, contractual protections and provider security measures).

If you would like more information about international transfers related to your booking, please email hannah@hannahvealephotography.com.

10) How long we keep your data (retention)

We keep personal data for as long as needed for the purposes set out in this policy, including legal, accounting, and service needs.

Typical retention approach

Client records (contracts, invoices, questionnaires): we may keep these for at least 5 years (and sometimes longer) to manage our business, respond to queries, and meet accounting/legal requirements.
Photographs/edited files: we aim to keep these for a minimum period (often aligned with contract terms), but we may retain them longer for archive purposes and to help clients who request re-access in the future.
Online galleries: galleries may become “offline” to clients after a period, but may remain stored in the backend for archive/admin purposes.
Mailing list: we retain subscriber details until you unsubscribe or ask us to delete them.

Deletion on request

You can request deletion of your personal data and/or images from our archive. We will comply unless we need to keep certain information for legal obligations (for example accounting records). Where we cannot delete something immediately, we will explain why.

11) Your rights

Under UK GDPR you have rights including:

Access: request a copy of the personal data we hold about you
Rectification: ask us to correct inaccurate personal data
Erasure: ask us to delete your personal data (with some legal exceptions)
Restriction: ask us to limit how we use your data
Objection: object to processing based on legitimate interests
Data portability: request transfer of certain data to you/another provider
Withdraw consent: where we rely on consent (e.g., marketing), you can withdraw at any time

To exercise your rights, email hannah@hannahvealephotography.com

Note on “rectification” vs creative edits: Requests to change retouching style or artistic choices are treated as a creative/service matter rather than a GDPR rectification request, though we’re always happy to discuss reasonable adjustments as part of our client service.

12) Cookies, analytics and advertising

Our website uses cookies and similar technologies.

What we use

Google Analytics (GA4) to understand website performance and usage
Meta Pixel (Facebook/Instagram) to measure ad performance and improve targeting
Embedded content (e.g., video or social embeds) which may set cookies from third parties

Managing cookies

You can control cookies through:

any cookie banner/settings on our website (where provided), and/or
your browser settings (blocking or deleting cookies)

Blocking some cookies may impact website functionality.

13) Security

We take reasonable steps to protect personal data, including:

Device passcodes and automatic screen locking
Two-factor authentication where available on key accounts (e.g., email, payments, galleries, CRM)
Use of a password manager
Sharing images primarily via secure gallery links rather than attaching full files by email

No method of transmission or storage is completely secure, but we work to reduce risk and respond appropriately to concerns.

14) If you do not provide personal data

If you do not provide the information we need (for example contact details, booking details, or information relevant to planning a newborn session), we may not be able to respond fully or deliver services.

15) Complaints

If you are unhappy with how we have handled your personal data, please contact us first at hannah@hannahvealephotography.com and we will try to resolve it.

You also have the right to complain to the UK regulator, the Information Commissioner’s Office (ICO). You can find guidance on the ICO website.

16) Changes to this policy

We may update this policy from time to time. The latest version will be posted on our website with an updated “Last updated” date.